Skillset

For those of you who have been following my eventful career, you already know that this is actually my second published tutorial. Just to bring you up to date, my first tutorial was titled Pas à Pas vers l’Assembleur and was originally written in April, 2009.After that, I made a small project called asmguru – a knowledge base & library for assembly developers.

There are lots of books concentrating on the topic of Assembly programming in general and Windows programming using the Assembly language in particular. This saga is intended for everybody who wants to master the art of x86 assembly language under the Win32 platform and start exploiting the security part of the Windows operating system.

Many people believe that assembly language is dead and useless when it comes to writing real programs. Somehow I do agree, but assembly is not only for coding, it is for Software vulnerability Analysts, Bug Hunters, Shell-coders, Exploit Writers, Reverse Code Engineers, Virus Authors, and Malware Analysts. Indeed, when you spend your day reading ASM routines, then ASM becomes a must.

This saga is more code oriented than theory, so you will be provided with all materials and resources in the first of each part. I really don’t support theory when it comes to programming. In others words, blabla is in the books, code is what you’ll find mostly here. Additionally, code will be highly commented and structured, written with the JWasm Assembler, for the Intel x86 architecture and can run under the Windows 32-bit platform.

First and foremost, our objective is to learn:

Windows System Programming

Portable Executable Format

Self-Modifying Code

Code Protection, Anti-Reverse Code Engineering

However, many people should not be familiar with:

IA-32 Instruction Set

Assembly Language Foundations

JWasm Assembler Syntax

Win32 Programming

Tools of The Trade (IDA Pro, Immunity Debugger, WinDBG, …)

As a consequence, before getting directly to discovering the security of Windows, we need to have a solid background and handle some prerequisites. So, we will start by giving you a complete look at the assembly basics and the Windows API Programming, then we will move to the hearth of windows at kernel mode level and Windows internal related stuff. Afterwards, we will explore the Portable Executable File Format, and we will try to write self-modifying code, polymorphic and metamorphic engine. Finally, we will end our journey by looking closer at some advanced anti-reverse engineering techniques and code tampering.

Each code will be structured in the following way:

New Concepts

New APIs

Key Notes

ASM Code

Output

In some cases, as in the Part I, there is a book called Programming Windows from Charles Petzold, It’s an amazing book and it teaches Windows programming; unfortunately, it’s in the C language. I said to myself instead of writing ASM code directly, why not reconstruct the code from the disassembled C code. You’ll look how C Code is disassembled, you’ll reconstruct it in ASM, then you’ll look at it again to see how much closer your code looks to the disassembled one.

We will follow this Reversing – Coding – Reversing approach as much as possible.

Before we go on with this saga, every time that you read it, it’s going to make more sense to you. Every time that you go back to the principles that you’ll learn here, it is going to hit you in a different level. What that means is like: if you go out now, maybe the surface level principles are hitting you and a year from now the same principles that you learn from here will take on a different meaning, and five years from now – the time it took me to master assembly- it’s gonna have an entirely different meaning.

Ayoub Faouzi is interested to computer viruses and reverse engineering, In the first hand, he likes to study PE packers and protectors, and write security tools. In the other hand, he enjoys coding in python and assembly.

Thanks for comment. I do agree that RE will be more adequate than hacking. Also, I need to say that: this summary will be regularly updated and you should visited it as much as you can to figure out changes I’ve made.

It will help you navigate through this saga.

Ling Ma

I wrote memcpy, memset, strlen, strcpy, strcmp for glibc on Atom, Nehalem, Sandybridge with 32 and 64bit x86 assembly language, language should be like a key to open different systems, i.e. Visual Basic help me to open SQL Server database, C help me to know linux kernel and x86 assembly make me in depth understand computer microarchitecture so that our code reached processor limit.

To andrew, KerlG
Thank you very much for the comment, part 1 is already done, happy lecture.

Anouar Ilham

I’m fanned ! the way you teach asm. I’ve been using Python for quite some time now, and I absolutely love the ease of use and flexibility, but I really want to get closer to the hardware for some iter mathematics that I’m working on. I’m also intrigued by being so close to the hardware, with absolutely nothing holding you back from using everything it has. I’ve researched for introductions to Assembly and to me they go much faster than they should. They jump straight into registers and operations without explaining what exactly they are, and why they matter. I’d love to see an in-depth introduction to Assembly, to make sure you understand the concepts before proceeding to any kind of programming with it. And it looks like I’m in the right place !!!

@Hailay, Steeve, Enjoy ! I’m working hard to make this seriy as suitable as possible to everyone. If you have any question, feel free to ask ..

KillToPay

This sounds interesting thanks for the time spent on this will check this very regularly !

Ayoub Faouzi

Awesome ! Interesting code is coming soon … Stay tunned.

Sebastien Nick

Oh Wow! Thank you so much! Very Rich Infos are waitting are waitting for us.

Ayoub Faouzi

Thanks Sebastien Nick. Part 3 is coming today.

Matthias Muenzner

That “……” makes me grrrrrrrrrrrrr

Please work faster haha

I am waiting :) So eager to finally understand it well!

Thanks in advance!

FERNANDO Blasko

This is actually better then my teacher explained it to me at school, and he’s supposed to be a ‘veteran’.
Very very well done.

About InfoSec

InfoSec Institute is the best source for high quality information security training. We have been training Information Security and IT Professionals since 1998 with a diverse lineup of relevant training courses. In the past 16 years, over 50,000 individuals have trusted InfoSec Institute for their professional development needs!

Join our newsletter

File download

First Name

Last Name

Work Phone Number

Work Email Address

Job Title

How will you fund your training?

Why Take This Training?

What is your timeline for training?

InfoSec institute respects your privacy and will never use your personal information for anything other than to notify you of your requested course pricing. We will never sell your information to third parties. You will not be spammed.

Comments

What is Skillset?

Skillset

Practice tests & assessments.

Practice for certification success with the Skillset library of over 100,000 practice test questions. We analyze your responses and can determine when you are ready to sit for the test. Along your journey to exam readiness, we will:

1. Determine which required skills your knowledge is sufficient
2. Which required skills you need to work on
3. Recommend specific skills to practice on next
4. Track your progress towards a certification exam